

Freedom of Information 

and 

Privacy Acts 

FOIPA# 1 05628 7 and FOIPA #1 056307-1 
Subjects: DCS-3000 and RED HOOK 
File Number: DIVISION DOCUMENTS 
Section: 22 



Federal Bureau of Investigation 




I just spoke with | | Everything seems to be in order. We'll see how this thing works on the cluster 
ring.... i i 

Tentatively speaking, week of 27Feb. We'll give a definite date after I speak with| |to check his 

schedule. 

be 

hlC 


Thnx, 




]to get some of the answers for vou J I is on V acation till 


I am forwarding this message t d I to get some of the answers for vouJ 

a The DCS-3000 is now in the Shield. It is probably about 150-200 feet between the DCS 
What we can do i s run a lo nger CAT5 from the port and move the DCS-3000 closer tc[ 


se nse to have a DCS-3000 out there for contingency purposes. You will need a 50 ft. cable for out there too. 

^ l^will be ordering a static DSL line into the Shield in the next couple of days. I got authorization to put it under 
our covert Title III account 


Thanks for the help. 
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ALL INFORMATION CONTAINED 
HE EE III IS UNCLASSIFIED EXCEPT 
WHERE SHOOT OTHERWISE 


DATE: 06-07-2007 

CLASSIFIED BY 65179/DHH/ESR/HAJ 

REASON: 1.4 (B/G) 

DECLASSIFY ON: 06-07-2032 


MON RECORD 


be 

b7C 


In preparation for the One Way Push installation I'll need to know what length serial cables are 



use 20ft, 35ft, and 50ft denomonations. Please call if you have any questions. 


J (NY) (FBI) 

Kttf, 2006 9:03 AM 
If OTP ) CFBI)f— 
t OTD) (FbIT 


\ know you are avoiding me. The sooner the better. We will start w ith the DCS-3000 targets first. Once 
we get those working, we will start on some CALEA T-ls. I have the l t naking a list for me regarding how many 


targets come from each CO. We will si 
have some numbers I will let you know, 
questions. Talk to you soon. 


jagest Central Offices first and then go from their. Once I 
js the TTA in charge of the DCS-3000 here if you have any 


I (OTP) (FBI) 

3v. j anua'iv 25. 2006 5:30 PM 

EPDl If OTP) (FBI) 


I spoke with l I today and he has already discussed I I ssues and 

concerns at length. We discussed some possible system configurations, implementation 
approaches, and pilot testing. Upon my return to ERF, we will complete our configuration 
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^I§ET © 

prepara tions, perform laro tests to verify operational performance, and will prepare for 
j I nstallation. More details to follow. If you have any further questions, feel free to 
give us a call. Hopefully, mid to later-part of Feb2006? 

Peace Out. 


PS - We aren't avoiding you, just stalling for opening day at Yankee Stadium... 


fo2 

b7E 


Original M essage 

From: I H fNVUFBn 

Sent: 2006 9:17 AM 

To: I I fOTDl (FBI) 

Cc: I I 70 TP) (FBI) 

Subject: | j pgrade and CaLea 

o.TK.O.-r.wr- p UT IED 

NON-RECORD 


be 

b7C 




B ss we just did 01 
n my office to pui 
Know when we can do this. Soon is better than later. 


Q hould allow us to do CALEA now corre ct? I want ! I to 
Dur FISA from the DCS-3000 into | fe nd see how it works. 


0 work 

v it works. Let me 


I think a vacation in NY for a couple of days is just what you need. What do you think? 


* hV6 Squad SO- ^ 

work: 212; 

cell: 91 


be 

b7C 


OCNOIT I VC PU T UNeL/ q 
SFAf-erm/F r- g ■ wgt — 
SL N G I T I VC BUT UMOLAP Stf 


S E NS IT IVE BU I 


SSNSmVFRIIT.IINQI flfifflF IFH 
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he 

hue 


To: 

Cc: 

Subject: 

Importance: 


I k errm (FBI) 

9:25 AM 

I I (OTD) (FBI) 

I I (6tD) (FBI) 

fw: continued fisa troubles 

High 


■ bLu 

RECORD 31 5B-KC-84652 

I 


Is there anything that can be done to resolve these issues with l H /Vhat do I need to do in order to get a resolution. 

Do you believe the issue i d 1 r '~ r ' 


|]or DCS-5000? 


•joinal Message- 


b2 

b6 

fo7C 

b7E 


□ (KC) (OGA) 


Se nt: Wednesday. August 24 . 2005 7:08 PM 
To l I (KC) (FBI) 


:° F~ 

iubject: 


Subject: Continued FISA troubles 


Team) (FBI)C 


□(KC) (FBI); [ 


J(KC) (OGA) 


RECORD 31 5B-KC-846S2 


fofi 

b7C 


We're going to need to bypass the latchbox on the primary !" - I The packet I left for you yesterday (23 August) b7 e 

details call activity and line troubles for the past 10 days. 


Our DSC3000 crashed overnight and we lost our pen data for the past 36 hours. 


The new problems incurred by the stopgap measure are outweighing those it was designed to overcome. 


Respectfully, 


1 Wflssmty LHvlilA'rii 11 ■ 
Wichita, Kansas RA 
FBI /TTTF 

C316)1 [(Desk) 

(316) fFax) 


b2 

b6 

b7C 



20 




fo6 

b7C 


From: I F BH) (FBI) 

Sent: Thursday. January 66 200 5 12:39 PM 

To: I I (HD) (FBI) 

Subject: RE: Upcoming TICTU Regional Conferences 


UNCLASSIFIED 

NON-RECORD 


1 . We want to ensure that we have in our possession the most accurate and up to date 24/7 contact numbers for court 
orders and emergency requests. The ones for criminal and the ones cleared for FISAs. What access and info can we get 
by without an order or delayed order. 

2. As FISAs become more prevalent, we need | [ solution to j | without long delays. j^g 

3. What is the most they or their systems can do to trace/tack f [ (with or withou t I jj ?72 

4. Can we get the time zone [ET, CT, MT, PT) of the location of the target's calls included on the DCS 3000. 

5. Any foreign telephone service available to subscribers (outside US) and will we be able to receive real time data? 

In other words, the implications of world wide service availability. 


— -original Message--— 

From: l I flTD^ (FBI) 

Se nt: Tuesday, Janua ry 04, 2005-SL13. AM 

Cc: | I OTP) (FBI); I I OTP) (FBI);[ 

Subject: Upcoming TICTU Regional Conferences 


] (ITD) (CON) b; 


NON-RECORD 


In the first half of 2005 the Telecommunications Intercept and Collection Technology Unit (TICTU) plans to once again 
host two regional conferences. These forums will provide specialized training to field office practitioners responsible 
for telephone ELSUR operations and foster cooperation between the FBI and the nation's telecommunications 
industry. 
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L 





TICTU is currently developing the agendaric these conferences and requests your suggestions for agenda topics and 


carriers of particular interest. We need your i nput as soon as j 
may send your ideas to me via email or conti 


;ib| 
it 703 


can set a tentative agenda. You 


\ 



a — r — -trn 

NON-RECORD 


Greetings. . . 

I am checking in to see if you have had a chance to install the van integration package (aircardj letc) you 

received at the RTL conference in Tampa. 1 I 


If you haven’t, please take some time this week, to do so. I would also like to run a few tests with each of you with a test 
phone to confirm it's working. ^ 

You will need to work with l Ion the DCS -30D0 side to be able to configure your target for the 10-20 van 11 

integration. He can be reached at 703 1 


Please let me know if and when you have completed the install and tested it, 


If I don't hear from you I will start calling you and bugging you. :-) 
Thanks. 


~|work 

Jcell 


703 £ 

816 C 


b2 

fo6 

fc7C 

fc7E 
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I |(1TD) <FB1) 

Monday. August 23. 2004 10:53 AM 

I r um (fbi) 

RE: DCS 3000 C&A 


ISSM, Qua ntico Comp lex 
ERF (703) | | 

Original Message-- 

From ! 1 (ITD) (FBI) 

Sen t: Monday. Augu st 23, 2004 10:14 AM 
To: | J flXD) (FBI) 

Subject: DCS 3000 C8tA 


It's categorized as Tier 2. I've attached all the related documentation. fo7< 






© 


be ' 
h7C 


Cc£ 


mi£_; 


■ JfCVl (FBI)/ ■ ij 




rani 

| k CVXFM) 

SUQJSS! ratable Voicebox 


jevyTOL 


1 (MU; 


tCVUFBDir 


](CV) (FBI);! 




NON-RECORD 


□ 

Several months ago, I spoke to you regarding our task force squad that purchased its own Voicebox digital 
collection system and needed the OK from Security Division to use it on FBI cases. This is still in the works 
on our end, but we have a similar situation regarding a portable system and require the input of Security 
Division before we move forward. 


Quantico EftF has supplied our division with a portable Voicebox system, but it is currently in use in our 
Toledo RA. The case agent in our Youngstown RA would like to conduct an upcoming FBI T-III on a digital 
system (rather than cassette tapes), but we do not have another system available (niether does EftF). The 
local HIDTA has purchased a portable Voicebox system and has agreed to let the Youngstown RA use it for 
this T-III. The system will be operated in the RA space and would be connected to our DC5-3000 network 
to obtain telephone target data. According to ERF, there is an acceptable configuration which enables 
secure transfer of the data. The issue arises in regards to conducting an FBI case on a system that is not 
owned by the FBI. As far as the data and audio that will be stored on the system is concerned, if 
necessary, we could remove the hard drives from the system before it is returned to HIDTA (replacements 
would have to be supplied by the FBI and software reloaded by the manufacturer). 

From the security standpoint, can we use this system to conduct this upcoming T-HI? Are there any other 
issues that must be resolved? 

If you have any questions, please feel free to call me. 


Thanks^ 


be 

b7C 


Cleveland Division 
21 [office) 

2 It cell) 
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□ (HO) (FBI) 
12-2005 2:55 PM 
IJ (OTD) (FBI) 
JHO) (CON) 


for this case id 
id printed theT 
Jfor every DCi 


I . Th fJ I number that is allegedly calling the tot is : 

[calls from 09/1 0/05; 0946 hrs to 09/1 2/05; 1 935 hrs and found a 
6 calf we had. 


Unless thel lis being less than candid with the case agent I do not see a problem unless we need to take a lar ger 
snapshot of theTgrs incoming and outgoing calls. We will also recommend to the case agent that she subpoena thg“ 
phone records so we can match his charged calls with our equipment's calls. 


If you have any questions, please shoot me an email or give me a call. 


I(SA) (FBI) 

SmEE2Op05 1 1 :58 AM hie 
1 IfOTDI (FBI) 

lin San Antonio 


For some unknown reason, San Antonio keeps losing its l Is erver connection on the DCS 3000. I have no 

problem reconnecting, it's just that every couple of days I find the connection is lost and I have to reconnect. 






■ U N QLAaaiP i c p- 


SECRET 


From: I i (ER) (FBI) 

Sent: i nursaav. aphi m. Z004 5:2 6 PM 

To: ■ (FBI) 

Subject: FW: DCS 3000 Pen Mode 


I H jlader Bkqrd.ipq (2 

1 5. (W) (FBI), vc..! KB) 

NON-RECORD 




he 

b7C 



1 I ITD/ESTS/ATU 

( 703 ) | U 

Original 

From: | I (ER) (FBI) 

Se nt: Wednesday. March 31 . 2004 3:46 PM 
To: | I CER) (FBI) 

Cc: CLIFFORD MICHAEL (ER) (FBI); THOMAS, MARCUS C. (ER) (FBI);[ 
I 1 (Div09) (FBI) 

Subject: DCS 3000 Pen Mode 


](ER) (FBI); 

b7C 


U N CLASS i riEB - 

NON-RECORD 

be 
b7C 


As discussed, I would recommend that at the n ext possible upgrade (if not sooner), DCS3000 be 
redesigned to eliminate as an option th j S election (and any other full content option) once the 
PEN REGISTER selection has been made in the warrant category. In the interim, we should forward 
an EC to the field: 1) Affirming that SMS cannot be legally obtained with only a PR/T&T order, and 2) 
Alerting them to the misconfiguration potential and advising them to take care in configuration. 

I would note that the IITRI report on| |recommended not having combined full 

content/PR devices on the theory that miss-configuration could occur. That recomendation was one 
of the 3 (out of 11) that the FBI chose not to follow, arguing in part that we doubted that it would be a 
problem. IITRI stated in perteninet part: 
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PRIVILEGED DELIBERATIVE DOCUMENT - NOT FOR DISCLOSURE OUTSIDE THE FBI 
WITHOUT PRIOR OGC APPROVAL 


Technology Law Unit 
Engineering Research Facility 
Bldg 27958A, Room A-207 


lantin n VA 77138 
1 703] 1 

tx. 70^ 


TECHNOLOGY LAW UNIT - OFFICE OF THE GENERAL COUNSEL 
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sfe&ET 



|(OTD) (FBI) 

?nnfi 5-i o pm 

i OTP > (FBI) 
Assistance for St Louis 


I should have known better! 


Advanced Telephony Unit 
Operational Technology Division 
Office (703 
Mobile (703 
Fax (703] 


|(OTD) (FBI) 

7nn<i s :nq pm 
1 Iotpi (FBI) 
assistance for St Louis 


at' sj | The Magnificent .. 


-—Orig inal Message 

From: I I fOTDI (FBI) 

Sent: Thursday, May 11. 2006 4:52 PM 

To: I t SL) (FBI1:L — 

Cc: f ■— UTlOTD) (FBI) | 

Subject: RE: Request fessistance for Sf Louis 


inanils for the heads up, I spoke witl j |a 
specific phone, through the use of the bus-3( 
locate t he target. Keep us posted. 


a little while ago. On< 
1000, the magnificent 


i qp if q riptpr m 

i r 


:mined that the subject is using that 
[will work his magic and and help you 


Advanced Telephony Unit 

Operational T echnoloav Division 

Office (703 

Mobile (703 

Fax (703 

— Original Mes sage — 

From: I ■ '■ lr <g ^ (FBI) 

Sent: Thursday, May 11, 2006 4:47 PM 
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u pi CLAoa i n ep — 
NON-RECORD 


I have spoken wit H | concerning SL's "possible" need fori I 

The details are as follows: 

Case Agent | 1 (573) | | (O) (573) 1 If C) 

Location Cape Girardeau RA, approx. 120 miles South of SL. 

A drug related homocide investigation. One subject is in custody / Agents 
are attempting to locate the subject who is somewhere is S outhern Illin ois. 
Eastern Missouri, or Northwestern Kentucky. The carrier is| |Case 

Agent is obtaining the 2703D order as I type this, the AUSAs office advise 
the order should be ready by 05/11/06, but I will call you once I have it in 
my ha nds. A s soon as I have the 2703D and entered into our DCS-3000 I’ll 
contact j fc s he instructed. That's all I know at this point. 

Thx for your help - tm 


— -Original M< 

From: 

Sent: 


AJ MCLAOO i r tepr - 

NON-RECORD 



I (OTP) (FBI) 
7m 3:36 PM _ 

~3cotd) (FBnJ. 
□ (OTD) (FBI}f“ 
[assistance for Srra 


Advanced Telephony Unit 
Operational Technoloav Division 
Office {703| 

Mobile (703 
Fax (703 


— Original Mes 

From: 

Sent: 
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© 



NON-RECORD 


□ 

T he Cape Girardeu RA has the potential for needing the assistance 
o l I on a murder investigation. What do I need to do to get our 
regional team on standby? What does the case Agent need to do in 
the wav o f providing information, case Hx, ect? The carrier is 
I l and the geographic area is Western KY, South Illinois, 

Eastern Missouri (all very rural). Please advise. 

Thx-tm 







be 

b7C 


I |(OTD) (FBI) 

Thursday Maul 1.200ft 452 PM^ _____ 

(OTD) (FBI) — . ^ 

RE: Reques t a ssistance for St Louis 


Jcg)(fbo£^ 


Thanks for the heads'up. I spoke with ! l a little while a go Ones it 's determined that the subject is using that specific 
phone, through the use of the DCS-3000, the magnificent 1 j yill work his magic and and help you locate the target. 

|£sfe o us posted. 


Advanced i eiepnony unit 
Operational Technology Division 
Office (7031“^ — 

Mobile (703 
Fax (703; 


jji uGu vaojP i c ir 

NON-RECORD 


J (SL) (FBI) 
m 4:47 PM 

Ij(OTD) (FBD 

JkOTD) (FBI)| 

ssistance for St Louis 


I have spoken with l C oncerning SL's "possible" need for I I 

The details are as follows: 

Case Agen tl ~~1 (573]| |(0) (573) [ j C) 

Location Cape Girardeau RA, approx. 120 miles South of SL. 

A drug related homocide investigation. One subject is in custody. Agents are 
attempting to locate the subject who is somewhere is Southern Illinois, Eastern 
Missouri, or Northwestern Kentucky. The carrier is | fc ase Agent is 

obtaining the 2703D order as I type this, the AUSAs office advise the order 
should be ready by 05/11/06, but I will call you once I have it in my hands . As 
soon as I have the 2703D and entered into our DCS-3000 I'll contact l l as he 
instructed. That's all I know at this point. 

Thx for your help - tm 



o 



[=□ 

The Ca pe Girardeu RA has the potential for needing the assistance of 
| | on a murder investigation. What do I need to do to get our 

regional team on standby? What does the case Agent nee d to do in th e 
way of providing information, case Hx, ect? The carrier i d la nd 

the geographic area is Western KY, South Illinois, Eastern Missouri (all i b2 






Opei 

(7031 


lephony Unit 
' ' ilogy Division 



be 

b7C 




J (OTD) (FBI) 

10:18 AM_ 
JfQTDi rF BnJ 

-BDjCT 


NON-RECORD 


3otd) (FBI)C 


□(OTD) (FBI) 


□0TD)(FBI)£ 


□(CQ)(FBI) 


— Original Message — 

From: I ""I roml (FBI) 

Sent ^20069:21 AM 

To: Jrmrii r e e l) 

Subject: FW| | Resource 


b6 

b7C 


NON-RECORD 


H | l l'm not certain if this falls under your unit, or if you have any input, but I'm forwarding the below e-mail to you 
in case you do have input Thank you! 


be 

b7C 




NON-RECORD 


27, 2006 12:42 PM 
l(OTD) (FB I) 

^'VF) (FBI) 
Resource 


hZ 

blE 


1=1 


Please see the questions presented below. Perhaps you could inquks 
into this, especially the units that deal with telephonic intercepts ancf 


there regarding their input 



ecurity Compliance 


Unit 


b6 

b7C 


36 




It certainly seems like a useful tool. However, I share the concern that WFO requests could be tracked back to the 
FBI. 

While an UC account would address the concern for a single FO. Is it possible that HQ Security or wh omever could b 2 
contact this group and make an assessment re the danger of compromise. If the group is comprised oi l P 7E 

security officers - then our concern is lessened - but if the group is a private venture with no security awareness then 
the compromise issue becomes heightened. 



T 



Ail: 

If you already know this - please disregard. 

For those of you who are actively sendin g out NSL’s and or subpoena's for telephone subscriber 



NOTE - This resource ONLY provides the name and contact info of the service provider They 
do NOT provide any subscriber information. 



- 1 LA I II ML g- 




e 


I (OTP) (FBI) 
rail® 3:26 PM 
](IP) (FBI) 


ight now, ifs a manual - albeit relatively easy 

process to extract, decode, and present tne oata. we are wonting on a method for the DCS-3000 to automatically do 
this, but it will take some more development effort. For now, I can do the manual extraction as often as you need me to. 
Just let me know. 


I I (OTD) (FBI) 

Thursday. September 28. 2006 10:58 AM 
I I ITQDUCQN) 

RE: DCS3000 raw data question 


I|1H I W I II II II ~~ 

NON-RECORD 




I just verified this also. 


— Original Message — 

From: I 

Sent: Thursday, 


“□0TODXCON) 
atember 28. 2006 10:57 AM 
I (OTP) (FBI) 
u raw data question 


I just heard back from the IP customer. She had also talked to her Tech Agent and he had called someone at ERF 
and then told her that it was fixed. So they may have just set that parm to true. Thanks. 










Sent! Thursday. Septemb er 28, 2006 10:54 AM 
To: I p rODXCON) 

Subject: RE: DCS3000 raw data question 


-UNCLA SS IFIED 

NON-RECORD 


b6 


fo7C 


We’re looking into it right now. There is an configuration option that has to be set on the collection system to allow 
DTMF digits to included in the CDNRS report. I checked the system in Indy and it is currently set to true. This 
may have been recently adjusted. If so, no problem. If it was set to true before this data was collected then we 
have a bug. 


□ 


— Original 
From: 



Subject: 


Mes sage — 


Zl(rroD)(coN) 


hureriav September 28, 2006 10:10 AM 

l(oi 


lBffl 


DCS3000 raw data question 


JprroD) (FBI) 


Jb6 

b?c 


UNGLAOaiF tgP 

NON-RECORD 


i have a question from a customer in IP. She has a pen using a DCS3000 and is asking why she is not 
receiving complete information in the Raw Data. The example shown is a sample of what she is seeing. On 
the CDNRS file the record is as follows: 


b2 

be 

b7C 

b7E 


The Summary file shows the following for the same call: 





□ 

b6 
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We’re looking into it tight now. There is an configuration option that has to be set on the collection system to allow DTMF 
digits to included in the CDNRS report. I checked the system in Indy and it is currently set to true. This may have been 
recently adjusted. If so, no problem. If it was set to true before this data was collected then we have a bug. 


□ 


31 Message — 


3tOD)(CON) 


v. September 28^2 


■ baam raw data question 


_JrroD) (FBI) 


b6 

b7C 


HMCLASSIPIEP - ■■ 
NON-RECORD 


I have a question from a customer in IP. She has a pen using a DCS3000 and is asking why she is not receiving 
complete information in the Raw Data. The example shown is a sample of what she is seeing. On the CDNRS file the 
record is as follows: 






1 (OTD) (FBI) 

;otember 22. 20 06 3:46 PM 
FLA) (FBI) 
KGTD) (FBI) 

» Installation 1 


unuu\A^inE!T 

NON-RECORD 



If you have any ideas to help us improve the current technique or if you want to further discuss the problem, let me know. I 
hope to see you in Denver next month. 


— Original Mess age — 

From: I I fOTD) (FBI) 

Sent Friday, September 22. 200 6 2:56 PM 

To: I I otdI (FBI) 

Subject: FW: OWP Installation 

-gfjgt " rolc,en 

NON-RECORD b6 
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— Original Messag£^^^^___ i __ 

From: I In a' (FBI) 

Sent: Friday, September 22. 2006 1:06 PM 

To: I IfOTDl (FBI) 

Subject: V.<Wlnst»n 

NON-RECORD 7 ^ 


It's not a time s 


the agen 

calf we have to compare the time 
provided to us by the agent to the time that it was recorded in I | The time can be off any where from a couple of 

seconds to a few minute. Also I have been asked by the agents if the data and audio will ever be married together. If the 
current solution is not reliable then I do not want it. It will just create other problems. 


vigjtmjnggjnEi si 



— Original Message-- 
From: I 

Sent: Friday. Sei 


itember 22. 20 06 10:01 AM 
|A) (FBI) 

(OTD) (FBI) 


The OWP is not a i 
stamp problem? If 
wants to do. 


in at this time. I don't understand you when you say it will help you with your time 
thinks the OWP should be installed at your site then so be it. I'll check to see what he 


fc6 

b7C 



From: 

Sent: 

To: 

Subject: 


■uiiici ftnninpp— — 

NON-RECORD 


I I (OTD) (FBI) 

'Thnrcrlaw <Wamk Q r bnnft 4;40 PM 

I I (OTD) (FBI) 

5>3P 


be 

b7C 


Here's the SSP for the DCS-3000. 


□ 

DCS3000 System 
Security Plan 2... 


From: 

Sent: 

To: 

Cc: 

Subject: 


be 

b7C 


1 (OTDXFB') 


!□ (OTD) (FBI) 
"5006 4:22 PM 


tember 15, 

iLgJPJiEBJJ- 

t SF) (FBI) 
RE: Cell Sites inrormation 


gPUSITWL g uauaia ASSIHEg 
NON-RECORD 


b2 

b7E 


I I 

I found the problem in the database for th 

□ 


o 


CS sites in San Francisco and have remedied it. 


be 

b7C 


— Original 

From: 

Sent: 

To: 

Subject: 


(OTD) (FBI) 

iptember IS , 2006 10:4 1AM 




3°TD) (FBI) 


NON-RECORD 

n 


b2 


be 

b7C 



UhlCLftOOinEP — 1136 

NON-RECORD b7c 

□ 

Just give me a call, and I will show you how to use the DCS-1020 feature on the DCS-3000. 

□ 


-0T ^LM33 II I CD : 



-UNULA3J.il ILLS 
NON-RECORD 


□ 

I will configui 
software ai ' 

□ 


work with the DCS 1020. You will have to contacQ 


: b2 

for the DCS-1020 b « 

1K7,- 




Sent: 

To: 

Cc: 


|SC) (FBI); 


(OTD) (FBI),| 


Subject: Q 


NON-RECORD 




2006 8:35 PM 
[OTD) (FBI) 


hZ 

b7E 


■a 


Could you set up the Sacramento D SC 3000 computer to work with the| __t[agkinc£ 
We recently received the ne pssarvT " “ ' * 

to receive the call data in o J 


,/e would like to be able 
]/ve will also need the sonwate [acs i U 2 U) tnat goes with that system . 

Ib2 

b7E 


nri innrinrri 


From: 

Sent: 

To: 

Subject: 


IOTP) (FBI) 


□ (OTD) (FBI) 

□or 


DCS-3000 and DCSnet Paragraphs 


"nnfi r 9B pm 

J(OTD) (FBI) 


NON-RECOF^P ~ b7C 

□ 

Here are the brief descriptions of the DCS-3000 and DCSnet that you requested: 

DCS-3000 

In late 1996, TICTU spearheaded the development of a unique telecommunications access program called the 
DCS-3000. This system was designed to interface with the switching facilities of wireless carriers using new 
digital technologies and offering diverse "Personal Communications Services." Since that time, the DCS-3000 
has evolved into the FBI’s primary pen-register collection system for all CALEA enabled intercepts, capable of 
interfacing with many models of wireline and wireless circuit and packet switching systems. The DCS-3000 is 
also used by more than 50 other federal, state, and local law enforcement agencies for CALEA-based electronic 
surveillance. The certified and accredited system uses a suite of in-house developed software applications 
designed for a client/server architecture. The DCS-3000 system is currently deployed in all 56 FBI field offices 
and 29 resident agencies. These systems are interconnected using the DCSNET Peerless IP network. 




DCSnet 

The Digital Collection Systems Network (DCSNET) is a certified and accredited network for transporting all 
CALEA Call Data Channel (CDC) and 

various streamed VOIP Call Content Channel (CCC) data from the service provider sources to the proper FBI 
Field Office destinations. 
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The DCSNET has nodes in all 56 FBITieW Offices and 29 Resident agencies, with the current node total at 85. 
The DCSNET is utilizes 

the FTS2001 c ontract vehicle for its physical circuit connections and its IP traffic is encrypted and routed using 
I l etwork equipment. The DCSNET is monitored and maintained by staff from the Operational 

Technology Division's (OTD) Telecommunications Intercept and Collection Technology Unit (TICTU). 


| l(OTD) (FBI) 

Monday, August 28, 2006 5:04 PM 
I I SP) (FBI) 

RE: Single Warrant Database for DCS 3000 Clients (almost) 


I have re-configured all Clients except .100: 


s not running on this machine! 


Subject: RE: Single Warrant Database for DCS 3000 Clients (almost) 


Primary Client (H Q CMPj_ 

HQ T-lll Room 1 
HQ T-lll Room 2i 
HQ T-lll Room 2 
HQ FCI. Room 1 
HQ FCI Room 2 

Off-Site T-lll Room 1 4 
Off-Site T-lll Room 2 4 
Off-Site T-lll Rnnm 3 4 

Off-Site CMP l 
Off-Site TechUtticel 


— -Originnl Mmnr - , 

From: I I f OTP) (FBO 

Sent: Thursday, August 17, 2006 11:35 AM 

To: I 1 (SD) (FBI) 







Ill II I nr III II TT 
NON-RECORD 


All... 

For reporting: 

Please send (emaill vour r esponses to my unit chief,! 
the inspector, r I Thank you. I 



S BId 9, room 9-LL-14 

. or get out of the way." Thomas Paine 


fe6 

b7C 


j (on FBI Net) He will ensure they are passed to 


3l E jessaot 


JEEidSlL^UfiUSLl& 2006 9:5<L 
I . KLDHFBinT 


lsecDXCON) 
2006 9:5 6 AM 


IfLD^ (FBI U 

H rrom (FBni 


data call... URGENT!!!! 


TB77 mT 


Tm rFRi^r 


3oTD) (CON); 


illiri nnunrn foe 

NON-RECORD h7C 


All; 


Attached is a DOJ form that MUST be completed ASAP!!! 

Answer the questions to the best of you ability, with "unvarnished” answers!!! The inspectors WILL compare your 
written responses with their actual finding during the inspection. If the answers are "NO, or I don’t know", so state... 
do NOT fabricate answers that can not be verified/proven. 

Once you've completed the form... CALL me for submission instructions please!! 


Specific questions about the form should be addressed to the inspection POc| |@ 20^ 

Systems are: 1 1 


CWAN, CODIS, VICAP, CART SAN, OPDC LAN, DCS 3000, DDMS, ChemNet 


ITSS OCIQ CEED HANDBOOK- 


Uuantlco Complex 

CIS M. CISSP. IS S. PSEC, MCSE 
(703l| p id 9, room 9-LL-14 

..."lead, follow.or get out of the way." 


Mer 


|e Template 6 14 06.doc » 


be 

b'/c 


Thomas Paine 


WNOLA2>5mED 





From: 

Sent: 

To: 

Subject: 


I I (OTD) (FBI) 

l F rKj f y l Au q H pt JI OM a 5»Py 

I « OGCt (FBI) 

RE: Post-Cut-Though-Dialed Digits 


RECORD 66F-HQ-A1 247863 


The field controls this forwarding on a per target basis. 

□ 



fo6 

b7C 


—SCORET 

RECORD 66F-HQ-A1 247863 


Does the Field control the forwarding function from DCS3000 or can you over-ride that from ERF? 

PRIVILEGED DELIBERATIVE DOCUMENT - NOT FOR DISCLOSURE OUTSIDE THE FBI WITHOUT PRIOR OGC 
APPROVAL 


Science & Technology Law Unit 
Engineering Research Facility 
Bldg 27958 A, Room A-207 
Quantlc o, VA 22135 
Tel. 70S| ” 

Fax. 703 


— Oriojflj 

'rom: L 


Rk: h^-Lut-lhou^h-l 


RECORD 66F-HQ-A1 247863 


*0TD) (FBI) 
3:44 PM 

(FBI)j 


1(0TD) 
dialed I 


HtfEQiFBI) 

I (OTD) (FBI) 


b6 

b7C 


The pen-register data forwarded from the DCS-3000 to the DCS-5000 and DCS-6000 systems is unfiltered, raw 
data. In most cases this information is associated with a full content intercept order. Occasionally, field offices 
elect to forward CALEA-based pen-register data obtained under FISA pen-register authority to the DCS-5000. In 
these cases, the PCTDD are delivered and collected by the DCS-5000 and eventually uploaded to TA. 



be 

b7C 
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:T 


he 

h'7C 


b5 
b 6 
b7C 


— Original Message — ' 

From: I l OGO (FBI) 


Tol 

Eaday, August IB, 2006 3:35 PM 

_ 1 


CeT| 

tOTD) (FBI);| 

l(OTD) (FBI); | 

l(OTD) (FBI) 

Subject: 

RE: Post-Cut-Though-Dialed Digits 




RECORD 66F-HQ-A1 247863 


b6 

b7C 


I was under the impression from I I that DCS3000 itself does keep all data in an administratively accessed 
file used for debug ging, including PCTDD even when the default of do not record is selected. I thought I 
understoond l | to say that that file is overwritten over time, but otherwise, if the do not record default 
remains unchanged, the PCTDD does not go to TA or anywhere else. 


Is this not correct? 

PRIVILEGED DELIBERATIVE DOCUMENT - NOT FOR DISCLOSURE OUTSIDE THE FBI WITHOUT 
PRIOR OGC APPROVAL 


Science & Technology Law Unit 
Engineering Research Facility 
Bldg 27958A, Room A-207 £? 

Quantlc o, VA 22135 b7c 

Tel. 703f I 

Fax. 703| 


RE: Post-Cut-Though-Dialed Digits 


RECORD 66F-HQ-A1 247863 


□ 

When DSC 3000 is used for a FISA collection, doesn't the DCS 3000 pass all to the ! I DSC 5000) 
including the PCTTD -in other words for FISAs the DCS3000 does NOT use the default of not recoding 
the PCTTD???? I might have this incorrect, but I thought there were some differences. 




RE: Post-Cut-Though-Dialed Digits 


RECORD 66F-HQ-A1 247863 


|pGC)(FBI); 
IkOTD) (FBI); 


^OGC) 
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* 


FYI. 

Since OTD only acquires the information and passes it along, and since the determination on whether 
one set of PCTDDs is content and not addressing, routing, dialing or signaling can only be made at 
the field office or analyst level, there really is nothing technologically speaking that can be done to 
ensure that content determined PCTDD is not used for investigative purposes. 

However, OTD and STLU is proposing to amend the FD 871 which is required to be signed to 
authorize tech agents to implement a criminal or FISA PR to add a selection box requesting that 
PCTDD be recorded. That box will have an asterisk which near the signature line will alert approval 
signatories that "If Post Cut Through Dialed Digit (PCTDD) recording is required, approving authorities 
are certifying that they have read and will ensure compliance with the DOJ Deputy Attorney General's 
policy directive of May 24, 2004 prohibiting any investigative use of PCTDDs that are determined to 
qualify as content of communications." In this way, there will at least be a record with a staff level 
supervisor, and ASAC acknowledging the DAG Directive each and every time they approve a pen 
register. In the absence of the box being checked, the DCS 3000 default of not recording PCTDDs 
will remain unchanged (although we still have the problem of non CALEA compliant provider networks 
were we cannot use the DCS 3000 and have to use older PR decoders that do not have the same 
ability to shut off recording of PCTDDs). 

Please advise if you see any problems with this approach. 

PRIVILEGED DELIBERATIVE DOCUMENT - NOT FOR DISCLOSURE OUTSIDE THE FBI 
WITHOUT PRIOR OGC APPROVAL 



b2 

be 

b7C 


Science & Technology Law Unit 
Engineering Research Facility 
Bldg 27958A, Room A-207 
Quantic o, VA 22135 
Tel. 703) I 

Fax. 703 


be 

b7C 



RECORD 66F-H Q-A1 247863 


Docket Number PR/TT 06-102 


I just received a supplemental order from Judge Kotelly. The order is dated August 7. 

Judge Kotelly has ordered the FBI to submit a report no later than September 25. This report 
must contain: 

(1) an explanation of how the FBI is implementing its obligation to make no affirmative 
investigative use, through pen register authorization, of post-cut-through digits that do not 
constitute call dialing, routing, addressing or signaling information, except in a rare case in order 
to prevent an immediate danger of death, serious physical injury or harm to the National Security, 



fc2 

fc >6 

h7C 




addressing in particular: a) whether post-cut-through digits obtained via FISA pen register 
surveillance are uploaded into TA, Proton, IDW, EDMS, TED, or any other FBI system; and b) if 
so what procedures are in place to ensure that no affirmative investigative use is made of post- 
cut-through digits that do not constitute call dialing, routing, addressing or signaling information, 
including whether such procedures mandate that this information be deleted from the relevant 
system. 

(2) an explanation of what procedures are in place to ensure that the Court is notified, as required 
pursuant to the Court’s Order in the above captioned matter, whenever the government decides to 
make affirmative investigative use of post-cut-through digits that do not constitute call dialing, 
routing, addressing or signaling information in order to prevent an immediate danger of death, 
serious physical injury, or harm to the national security. 


You are in the building. Could you pick up copies of the order from me for STLU. 


^aw Polio 


National Security Law Policy and Training Unit 
FBI HQ Rooiai225_. 

STU III: f2Q2 i 1 


Secure Fax: (202 


a xiX 

02f" 




b6 

b7C 


From: I I OTP) (FBI) 

Sent: Friday Alin, .st 1 ft MMftA-nfl RM 

To: I ] (OTD)(CON) 

Subject: FW: Immediate inspection data call... URGENT!!!! 


Importance: High 


UnLLASJII tjD 
NON-RECORD 


□ 


I hope you can help with the following request. I'll be out of the office until 
questions that you may have just as well as I can. 




will be here and can answer any 


Thanks, 

□ 


— Original Mess age — 

From: 

Sent: 



b6 

b7C 


Isi lEBQl fo™ (CON); 

I (LD) (FBI) 


NON-RECORD 


All: 

Attached is a DOJ form that MUST be completed ASAP!!! 

Answer the questions to the best of you ability, with “unvarnished" answers! I ! The inspectors WILL compare your written 
responses with their actual finding during the inspection. If the answers are "NO, or I don't know", so state... do NOT 
fabricate answers that can not be verified/proven. 

Once you’ve completed the form... CALL me for submission instructions please!! 


Specific questions about the form should be addressed to the inspection POCl p 20 

Systems are: 1 ' 

CWAN, CODIS, VICAP, CART SAN, OPDC LAN, DCS 3000, DDMS, ChemNet 

rrss ocio ceed 

HANDBOOK - Merg.. 


b6 
b7C 

CIS M. CISSP. IS S- PSEC, MCSE 

17031 I Bid 9, room 9-LL-14 

..."lead, follow, or get out of the way.” Thomas Paine 


"(SuanHcoTJompleir 


\ I & 


UNCLAS S I F IE D* 
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S^RET 



From: 

Sent: 

To: 

Subject: 


I ( QTP) (FBI) 

Friday. AuausHS. 3:59 PM 
I K SecDifCON) 

RE: Immediate inspection data call... URGENT!!!! 


NON-RECORD 


be 

b7C 


□ 


I will be out of the office until 8/28/06. I will have one of our security analyst work on this in the interim. Also, I am 
concerned and curious how the DCS-3000 made this list and other more critical systems (i.e., DCS-5000, DCS-6000, 
DCSnet, and EDMS) did not. 


□ 


b6 

b7C 


— Original Message--- 

From: 

Sent: 

I In rv* rcBDr l 

, llTOD) (FBI fl 

Subject: Immediate Inspection data call... URGENT!!!! 


J(OTD) (CON); 


— UHHI ftSfilElED. 
NON-RECORD 


All: 


Attached is a DOJ form that MUST be completed ASAP!!! 

Answer the questions to the best of you ability, with "unvarnished" answers!!! The inspectors WILL compare your 
written responses with their actual finding during the inspection. If the answers are "NO, or I don't know", so state... 
do NOT fabricate answers that can not be verified/proven. 

Once you've completed the form... CALL me for submission instructions Please!! 


Specific questions about the form should be addressed to the inspection PO(T" 
Systems are: *— 


~> 202 | 1 


CWAN, CODIS, VICAP, CART SAN, OPDC LAN, DCS 3000, DDMS, ChemNet 

« File: ITSS OCIO CEED HANDBOOK - Merge Template 6 14 06.doc » 


Quantico Complex 

CIS M. CISSP. ISS . PSEC, MCSE 

17031 b id 9, room 9-LL-14 

..."l£aa, toiiow, or get out of the way." Thomas Paine 


b7C 


- uuaLAaair iEtr 


SEO 


ctlfT 
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~"|(OTD) (FBI) 


h5 

bo 

b7C 


From: I j OTD) (FBI) 


To: 

1 ' l(OGCWFBI):l 

IfOGC) (FBI) 

Cc: 

1 1 (OTD) (FBI);] 

| (OTD) (FBI) 

Subject: 

RE: Post-Cut-Though-uialed Digits “ 



■SECgS- 

RECORD 66F-HQ-A1 247863 


The pen-register data forwarded from the DCS-3000 to the DCS-5000 and DCS-6000 systems is unfiltered, raw data. In 
most cases this information is associated with a full content intercept order. Occasionally, field offices elect to forward 
CALEA-based pen-register data obtained under FISA pen-register authority to the DCS-5000. In these cases, the PCTDD 
are delivered and collected by the DCS-5000 and eventually uploaded to TA. 


□ 


al Messaa 


>GQ (FBI) 
!35 PM 


Subject: RE: Post-Cut-Though- 


2006 3: 

to (FBI) _ 
JOTD) (FBI)[ 
tfialed Digits 


b5 

b6 

b7C 


□(OTD) (FH)C 


JOTD) (FBI) 


RECORD 66F-HQ-A1 247863 


I was under the impression froml [that DCS3000 itself does keep all data in an administratively accessecLiilejised 

for debugging, including PCTDCTETCn when the default of do not record is selected. I thought I understoon J h o be 
say that that file is overwritten over time, but otherwise, if the do not record default remains unchanged, the PCTdD b7C 
does not go to TA or anywhere else. 


Is this not correct? 

PRIVILEGED DELIBERATIVE DOCUMENT - NOT FOR DISCLOSURE OUTSIDE THE FBI WITHOUT PRIOR OGC 
APPROVAL 


Science & Technology Law Unit 
Engineering Research Facility 
Bldg 27958A, Room A-207 
Quantic o, VA 22135 
Tel. 703 j ™ 

Fox. 703 


b2 

b6 

b7C 


From: I 
Sent: Fit: 

To: C 

Cc: I 

Subject: RE: 


amessage^— 


lav. August 18.2006 1:01 PM 

T i rren ( 

Post-Cut-Though-Dialed Digits 
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RECORD 66F-HQ-A1 247863 


T 


O 


nn 


When DSC 3000 is used for a FISA collection, doesn’t the DCS 3000 pass all to the l t PSC 5000) including the 
PCTTD -in other words for FISAs the DCS3000 does NOT use the default of not recoding the PCTTD???? I 
might have this incorrect, but I thought there were some differences. 


b 

b 



(OGQ(FBI) 

RE: Post-Cut-Though-Dialed Digits 


RECORD66F-HQ-A1247863 


FYI. 

Since OTD only acquires the information and passes it along, and since the determination on whether one set 
of PCTDDs is content and not addressing, routing, dialing or signaling can only be made at the field office or 
analyst level, there really is nothing technologically speaking that can be done to ensure that content 
determined PCTDD is not used for investigative purposes. 

However, OTD and STLU is proposing to amend the FD 871 which is required to be signed to authorize tech 
agents to implement a criminal or FISA PR to add a selection box requesting that PCTDD be recorded. That 
box will have an asterisk which near the signature line will alert approval signatories that "If Post Cut Through 
Dialed Digit (PCTDD) recording is required, approving authorities are certifying that they have read and will 
ensure compliance with the DOJ Deputy Attorney General’s policy directive of May 24, 2004 prohibiting any 
investigative use of PCTDDs that are determined to qualify as content of communications." In this way, there 
will at least be a record with a staff level supervisor, and ASAC acknowledging the DAG Directive each and 
every time they approve a pen register. In the absence of the box being checked, the DCS 3000 default of not 
recording PCTDDs will remain unchanged (although we still have the problem of non CALEA compliant 
provider networks were we cannot use the DCS 3000 and have to use older PR decoders that do not have the 
same ability to shut off recording of PCTDDs). 

Please advise. if you see any problems with this approach. 

PRIVILEGED DELIBERATIVE DOCUMENT - NOT FOR DISCLOSURE OUTSIDE THE FBI WITHOUT 
PRIOR OGC APPROVAL 


Science & Technology Law Unit 
Engineering Research Facility 
Bldg 27958A, Room A-207 
Quantic o, VA 22135 
Tel. 703f I 

Fax. 7031 


b2 
b 6 
fc>7C 





Cc: I IfOG O (FBI);t__ 

■ unon (FBI) 

Subject: Post-Cut-Though-Dialed Digits 

Importance: High 


RECORD 66F-HQ-A1 247863 


IN RE| | Docket N umber PR/TT 06-1 02 

I just received a supplemental order from Judge Kotelly. The order is dated August 7. 

Judge Kotelly has ordered the FBI to submit a report no later than September 25. This report must 
contain: 

(1) an explanation of how the FBI is implementing its obligation to make no affirmative investigative use, 
through pen register authorization, of post-cut-through digits that do not constitute call dialing, routing, 
addressing or signaling information, except in a rare case in order to prevent an immediate danger of 
death, serious physical injury or harm to the National Security, addressing in particular: a) whether post- 
cut-through digits obtained via FISA pen register surveillance are uploaded into TA, Proton, IDW, EDMS, 
TED, or any other FBI system; and b) if so what procedures are in place to ensure that no affirmative 
investigative use is made of post-cut-through digits that do not constitute call dialing, routing, addressing 
or signaling information, including whether such procedures mandate that this information be deleted from 
the relevant system. 

(2) an explanation of what procedures are in place to ensure that the Court is notified, as required 
pursuant to the Court's Order in the above captioned matter, whenever the government decides to make 
affirmative investigative use of post-cut-through digits that do not constitute call dialing, routing, 
addressing or signaling information in order to prevent an immediate danger of death, serious physical 
injury, or harm to the national security. 


You are in the building. Could you pick up copies of the order from me for STLU. 


hi ational Security Law Policy and Training Unit 
FBI HQ Room 7975 
STU III: (202) 1 ~| 

Unclassified Fax: (2021 
Secure Fax: (202) I T 




60 



From: 

Sent: 

To: 

Subject: 


b6 

b7C 


J(OTD) (FBI) 
m-sfi am 


post cut ,i nrough Digits 


] (OTD) (FBI); CLIFFORD, MICHAEL (OTD) (FBI); 

JDGC) (FBI); THOMAS, MARCUS C. (OTD) (FBI) 


llhin 

NON-RECORD 


Gentlemen, 


I checked all 56 field office's criminal pen-register DCS-3000 systems for post cut through dialed digit information. The 
attached spreadsheet list the field office and the observed data for the office. Rather than counting all targets with and 
without the dialed digit extraction option set I categorized the data as All, Most, Some, Few, and None. All means all 
targets in the system are currently set to collect post cut through digits. A ranking of Few means th e ma jority of the 
targets are set with the option turned off. For example, WFO was ranked Few because onlynout o | ( current targets 
were set to collect post cut through digits. 

A summary of the results: 

Field offices with All targets set: ! I 
Field offices with Most targets set II 
Field offices with Some targets s et:| | 

Field offices with Few targets s et! J 
Field offices with No targets set l I 

I I 


□ 


11 


be 

b7C 


Post Cut Thru.xls 
(19 KB) 


fo2 

b7E 


T J I' ICLABCI WED. 


61 


□ (OTP) (FBI) 


Sent: 

To: 

Subject: 


be 

fo7C 


NON-RECORD 


Since this is a new direction for us, I hawa daciripri tn snak the application on iust fhrea Client machines before going for 
the whole enchilada. The clients or! lave upgraded and configured. The .5 

machine is the master, and from th J ijuiui t e st i u i u usmy my | i iumuei as a -rferqet seemed to work without any 
problem. So, give it a go for a while and if it holds up I will upgrade all the other machines. 


bl 

fo2 

b7E 


□ 


— Original Message — 

From: I ] (SD) (FBI) 

Sent; Thursday, August 17. 200 6 3:35 PM 

To: I tOTDHFBI) 


Cc: 

Subject: 


RE: Single Warrant Database for uu> juou uients (almost) 


](SD) (CON) 


be 

b7C 


NON-RBPOR^ ** 


(S) 


(S) 


Primary Client (HQ CMP)- 

1 

HQ T-itl Room 1 
HQT-III Room 2e 
HQ T-lll Room It 
HQ FCI Room 1 - 
HQ FCI Room 2 - 


— 1 

Off-Site T-lll Room 1 - 
Off-Site T-lll Room 2 - 

□ 

Off-Site CMP \ 



bl 


— -Original Message — 

From; I "*l (OTD) (FBI) 

Sent: ^^.^3,^.1.7^2006 11:35 AM 

To: I r SD) (FBI) 

Subject: Single Warrant Database for DCS 3000 Clients (almost) 


NON-RECORD 


be 


b7C 


□ 


62 T 

SEk<ET 


I 


b2 

b7E 








9 


I "[. ^QTD^ <FBI| 


From: 

Sent: 

To: 

Cc: 

Subject: 


] (OTD) (FBI) 

■Thursday. AuqusUZ.2Qfifi9:38 am 

IjHN) (FBI) 


Guam” 


jmm 


he 

b7C 


NON-RECORD 


□ 


Before you attempt to push the CDC data from the DCS-3000 into the| 

caseids he's using: I c hecked your GR30 data this morning and the case 
changed the push to th a I vill be useless. 


□ 


be 

b7C 


, ju should havei ""fc hange the b 

is sti | p r ail your targets. If this is not b 


dZ 

From: 

Sent: 

To: 

Subject; 


kOTDXFBI) 

I | (OTD) (FBI) 

9^35 AM b6 

RE: DCS5000/Different time zones/dates/Hi LO Server fc7c 


^ECWCT *■ 
RECORD 22SC-HN 


Honolulu needs to configure the intercepts on th e! l and on the low side machine. If the data arrives at the I l or ; b7E 
near the same time as the audio is received th e| { will correlate the two data streams, regardless of the time stamp in 
the data. The linguist in Po rtland sho uld see a FIN timestamp in the session window - very close examination in the 
telephony log will reveal the l T nestamp. But, I don't think the linguist are looking at the telephony log timestamps - 
shouldn't be a problem. 


□ 


1 (OTD) (FBI 
17.200 6 7:35 
tOTD) (FBI) 


Subject: FW: DCS5000/Different time zones/dafces/Hi LO Server 


RECORD 225C-HN 


b6 

b7C 


□ 

Please let me know when you will have time to discuss this. 

se&4t 


64 





— Original Message- — 

From: I IfHN'ffBn h6 

Sent: Wednesday. August 16, 2006 10:02 PM fo7c 

To: I 1 (OTD) (FBIj 

Cc: 1 I HNI fFBn l I HN1 (FBI) 

Subject: DCSSOOO/Different time zones/dates/HI LO Server 

-ctip.rtLl 

RECORD 225C-HN 


Got a situation hopefully you can help us. 

■ MM h-ar t EISA ill 


b2 

b7E 1 


The CCC being received on the 5000 is showing HN time. We need the 5000 to match the CCC and CDC if it can be 
done. Our understanding is the 5000 will not match the CCC and the CDC as the times/date are vastly different. Or, 
will the 5000 matc h the CDC and CCC according to the time rece ived in HN, notwithstanding the actual date/time 
shown in the CDCl" 


(Example: I 


I understand we need to go through the HI/LO server on a one-way push for the CDC to the 5000. We never used the 
HI LO for any previous calls. Any info on how we should do this is appreciated. 

This FISA will be long term. If the CCC and CDC are not matched in the 5000 can there be software changes so we 
have a solution? 


Our situatioruaaMiie iiDiflUfiiQihe Iwftflii .since HN jurisdiction c 
do FISAs on | \ 

Thanks 


TT A Honolulu Division 
808 iDesk 

808 1 jCell 


be 

b'/C 







I (OTD) (FBI) 

2006 3:53 PM 
J (OTD) (FBI) 


Original Message 

From: ~ 

Sent: —X 


WF) (FBI) 

3 12:31 PM 
OTD) (FBI) 




b7C 

202 

'Desk) 


202 

'Cell) 


202 

'Pager) 



— Original Message — 

From: I I (OTD) (FBI) 

Sent: Monday. August 14 2006 12:04 PM 

To: . I T WFI ( FB i) 

Subject: RE: Not a survey 


I think it best if someone from your office replies. ! l is asking if your office enables the "post cut thru dialed digits" 
for each pen-register (criminal and FISA) target as a matter of policy/practice. The default on the DCS-3000 is not to 
allow the digits dialed by the target after the call is setup unless the check box called "Post Cut Thru Digits” is checked 
for each target. I just checked your criminal DCS-3000 system, and the vast majority are set to "N", which means 
you’re not collecting all the digits just the 10/1 1 digits dialed at the beginnirifljQLtl3| calls for the majority of your targets. 
I assume this is due to policy/practice in the office. If so, your response toj ['just the first string of digits" in most 


SEgRET 









All, 


f 


Please see | j email below and respond directly back to him as soon as possible. Thanks! 


■Ori ginal Message — 


Sent: Monday. August 14. 2006 8:14 AM 


j(OTD)(COm 


a surlej" " 


TBTBTcFBI) 


kaa imE. 


JjOTD) (FBI)^ 


] QTDUFBn;l!! 


_pfTD) (FBI); 


]0TD) 


b6 

b7C 


NON-RECORD 

| { please forward to all TS/TA’s for a response. 

Ladies and Gentlemen, 

Can everyone please send me a very short reponse on the practice your offices follows in the use of the DCS- 
3000. Do you ONLY capture the first string of numbers or do you use the toogle to capture ALL numbers. 


Since there are many options available to us on how much dialed information we collect we need to know what the 
norm is around the country. I understand that some of you will answer it is on a "case to case" basis, but I am just 
looking for the norm in your office. 


Thanks for your quick response. The legal guys need this information to talk to all the options the DCS-3000 
allows. 


[=□ .* 


Tech nical - 
O: 54d 
C: 202 


Personnel Development 


Unit 


UNGLA6S I F I EQ 

U N OLAce i n ee- 


-quujujii iLie - 


gFK HTI X,F PIITIIMri feSgjHjB r 



l(OTD) (FBI) 

2006 3:47 PM 
J(OTD) (FBI) 


— Original Message 

From: I 

Sent: Monda 


Subject: FW: Not a survey 

6E NB nW & WT UHOLAOOinCD 
NON-RECORD 

Were you aware of this request? 


J (OTD) (FBI) 

1. 2006 12:11 PM 
I OTP) (FBI) 


From: I IW Fl (FBI) 

Sent: Mnnrlau Airnngt 14 9:37 AM 

To: I | (OTD) (FBI)£ 


Subject: FW: Not a survey 

QFMQ1TIWP P- ~ • ^ Qir i E P — b7C 

NON-RECORD 

Hey guysll Could one of you please respond to | [ s-mail? We are not quite sure what he is asking for. 


JWF) (FBI) 
□±2006 9:1 4 AM 
3WF)(FBI)J” 


1 — 1 

202 

202 

202 


Desk) 

'Cell) 

'Pager) 


tJWttWQIFlEO 

NON-RECORD 


See l p -mail below. I 

do the same regarding the Criminal side. 


an you advise me regarding the FISA side of the Unit } [ an y 




© 


Thanks 

□ 



be 

b7C 



All, 



Subject: Not a survey 

Importance: High 



b6 

b7C 


Ladies and Gentlemen, 


Can everyone please send me a very short reponse on the practice your offices follows in the use of the DCS-3000. 
Do you ONLY capture the first string of numbers or do you use the toogle to capture ALL numbers. • 
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Since there are many options available to us on how much dialed information we collect we need to know what the 
norm is around the country. I understand that some of you will answer it is on a "case to case" basis, but I am just 
looking for the norm in your office. 

Thanks for your quick response. The legal guys need this information to talk to all the options the DCS-3000 allows. 



b7C 



□ 


Technical 

0: 54<J 

C: 202j 

Personnel Development 

Unit 


iihin AnniwEcr 

- UMCLAQOIM EP- 


i 

From: 

Sent: 

To: b2 

Subject: b7E 


l(OTD) (FBI) 


I I (OTD) (FBI) 

Monday, Auaust 14. 2006 12:05 PM 
I l(OTD) (FBI) 


be 

b7C 


RECORD 31 5N-SD-62550 


Yes. 


b2 

b7E 


— Original 

From: 

Sent: 

To: 

Subject: 


Pjpccanp- 


U(OTD) (FBI) 


12:05 PM 
| (OTD) (FBI) 


RECORD 31 5N-SD-62650 


be 

b7C 
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be 

b7C 


e 


i — | 

Do you have this? 


— Original Message — 

From: I 


To: 

Subject: 


t=F DCS3000 


J(SD) (FBI) 

19, 2006 7:47,261 
(OTD) (FBI);L 


secre r 

RECORD 315N-SD-62550 


JoTD) (FBI) 


I forwarded all th | I sessions I had for 8/8-9/06 (up through about 1 530 hrs) and attached is a | caoy of the DCS3000 
«2 report for this same period. You will see that DCS shows Associated DNs in some sessions and | | does not. You 
b' ? E W j[| see that DCS3000 shows more calls that f [ reports. Thanks for all you've already done. 




sTnSHIV^ BU I UHILLAJJ i riCD - 
NON-REC ORD. 


□ 


1 think it best if someone from your office replies, 
each pen-register (criminal and FISA) target as a mat 


js asking if your office enables the "post cut thru dialed digits" for 
of policy/practice. The default on the DCS-3000 is not to allow 
the digits dialed by the target after the call is setup unless the check box called “Post Cut Thru Digits" is checked for each 
target I just checked your criminal DCS-3000 system, and the vast majority are set to "N", which means you’re not 
collecting all the digits just the 10/1 1 digits dialed at the beg inning of the calls for the majority of your targets. I assume this 
is due to policy/practice in the office. If so, your response td Ijust the first string of digits" in most cases. 


— Original 

From: 



(FBI) 
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bb 

b7c 





Subject: FW: Not a survey 


Please see j ~^ mail below and respond directly back to him as soon as possible. Thanks! 


_JOTD) (FBI) 
LOTS 8:14 AM 
JOTPirCON ) 


Subject: Not a survey 

Importance: High 


| fr lease forward to all TS/TA's for a response. 


Ladies and Gentlemen, 

Can everyone please send me a very short reponse on the practice your offices follows in the use of the DCS-3000. 
Do you ONLY capture the first string of numbers or do you use the tcogle to capture ALL numbers. 

Since there are many options available to us on how much dialed information we collect we need to know what the 
norm is around the country. I understand that some of you will answer it is on a "case to case" basis, but I am just 
looking for the norm in your office. 

Thanks for your quick response. The legal guys need this information to talk to all the options the DCS-3000 allows. 


-Personnel Development 


"" UNCLASSI FI ED 




l (OTD) (FBI) 
August 14. 2006 11:44 AM 
f SD) (FBI) 

JOTD) (FBI) he 
”|vs DCS3000 fc7c 


La st Wed nesday, we set a trap on the high side of the one way push system to verify data delivery from the DCS-3000 to 
th j | Have you seen any discrepancies since Wednesday? If so, please forward a sample to us so we can investigate 
using the packet sniffer data. 


Original Me 

From: | 

Sent: TJ 



RECORD 315N-SD-62550 


I forwarded all the l I sessions I had for 8/8-9/06 (up through about 1530 hrs) and attached is ac 
report for this same period. You will see that, DCS shows Associated DNs in some sessions and V 
will see that DCS3000 shows more calls thatl leports. Thanks for all you've already done. L 


DERIVEtTFROM: Multiple Sources 
DECLASSIFICATTSftLEXHWWTSNI 


'DEMUED FROM: Multiole Souwes^ 
DECLAS^TPt ^yp*^ ^^ION 1 
SECRET- — 



I rOTD) (FBI) 

Wednesday, August 09, 2006 5:32 PM 
HQ_DIV20_OIPP_CMQA 

RE: Just a friendly reminder - FISMA Change Request Reports are due on August 11, 2006. 


July 2006 CR Status for DCS-3000. 


— Original Message — 

From: HQ_DIV20_OIPP_CMQA 

Sent: .^unwitav Annnst 09, 2006 1 1 ‘A 


Please provide the Change Request (CR) status for your system during the month of July 
2006 by COB Friday, August 11th. The attached template needs to be completed and return 
back with your signature (type your name on the signature line), even if there's been no 
change to the system. 

Please keep in mind that the System Owners (PMs) are responsible for coordinating with 
the System ISSOs to review all CRs associated with the system. The ISSOs are required to 
review all CRs for any impacts to the system and provide their decisions prior to the system 
level board meetings and the decisions must be documented in the board minutes. 

Please send reports and policy or plan to this mail box (HQ_DIV20 

_OIPP_FISMA_REPORT). 

If you should have any questions, please feel free to contact me | | be 
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|(OTD) (FBI) b6 

106 4:23 PM !>?' 
□ (SD) (FBI) 


We'll give it a shot. Good idea. 


— Original Message 

From: I I fSDUFBn 

Sent: Tuesday. August 08. 2006 2:18 PM 

To: I r OTm (FBD:[ 

Subject: DCS3000 


At the risk of sounding lazy, is it possible to have an auto-update feature that would allow the input of a target into the 
warrant database on one client that would then allow you to select other clients you would like to populate with this 
same data. For many different reasons, some good, some not so good, we are in a position where we have the same 
target in multiple clients and not all are always remembered to be update at renewals. 


RE: PCTDD - DCS 300 


(FBI) 

AM 

OGC) (FBI) 


Sure. Where do you plan to meet? 


From: I I fOGCi (FBI) 

Sent: Friday. August 04. 2006 7 :04 PM 

To: I I OTP) (FBI) - 

Cc: | I (OTP! (FBI! : CLIFFORD, MICHAEL (OTD) (FBI);| 

M mi l K OGC) (FBI) 

Subject: PCTDD - DCS 300 







NON-RECORD 


be 

hie 


□ 

•Will you or someone from your shop be around Tuesday mid morning (10:30 AM), August 8th to provide me and a 
couple of DOJ attorneys a quick presentations on the capabilites and limitations of DCS3000 to restrict PCTDDs. We 
are struggling to come up with a strategy of dealing with the recent Texas Magistrate's ruling that law enforcement 
cannot collect any PCTDDs unless they utilize some technology so as to limit the collection of content. 


BTW. Telenor will be visiting in the FishBowl Tuesday afternoon to give a presentation orj [telephone systems 
on aircraft. 1 1 

lb 2. 

b7E 


From: 

' ‘ it:.. 


(» 


Cc: 

Subject: 


3ss UE 


RE I f 


ZD(OTD) (FBI) 

IQS 5:51 PM 

rOID.) f.FBD 

__ZI(OTD) (FBI) 


E4*H6 fcA 6 6l l=tee- 


NON-RECORD 


Symposium Follow-up Questions 

bl 

be 

b7C 


□ 

I don't see a problem sharing the date with any of the TTEC members. 


I don’t know if CIU is doing anything to address th 
several years ago. It still remains a problem. 


^ | roblem. Supposedly, it was documented by the SOLVER group 



— Original Message — 

From: I ** 



l(OTD) (FBI) 
iw-up Questions 


fol 

be 

b7C 


^lenr^fcr yui UHLl_HLL.il ICtT 
NO N-RECO RD 


f J Wow r Thatis amazing. Good iob I k nd thanks for the details. 
' w ' problem. Do you see any problem In sharing this -information 
only. 


re if our northern friends have the same b 6 

ince ifs a North America (maybe U.S.) issue b7c 


Also, do you know if there is anything being done 


vitt j | on th j j probU 


lem thru our CALEA test team. 


Electronic Surveillance Technology Section 
Operational Technology Division 


e 


(S) 


-r-Origlnal_M^age^^_ 




30TD) (FBI) 


Sent: Thursday, August 03, 2006 5:29 PM_ 

r 1(OTD) (FBI); I 

-oilow-up Questions 


NON-RECORD 


bl 

Jbb 

b7C 


b2 

b7E 


□ 

The problem I described at the TTEC meeting is related to wireless number portability. Today, U.S. wireless 
service providers are required to comply with the wireless number portability (WNP) mandate issued by the FCC a 
few years ago. WNP allows a wireless subscriber to take his/her telephone number from one carrier to another 
carrier. In essence the subscriber owns the telephone number, not the service provider. This mandate created 
technical problems for the U.S. wireless providers because their switching infrastructure routes calls based on 
telephone numbers: carrier owned (internal numbers) are usually routed differently than external numbers. 


Before WNP, routing calls were simply based on routing tables, which were populated with NPA-NXX and trunk 
combinations. These combinations are point codes the switch uses to determine how to route the call. WNP 
hinra tha riistmrtinn between internal and external n umbers and therefore complicates call routing, r 
if al fcu bscriber decides to switch service t q e nd renuests his number to be ported froi 

■ '—■“-i- 1 — '• have to accept the extemal l A ssigned number a" - 


t 

it as it it belongs 


witching network 

"C _3 


To route and manage external numbers as internal numbers, the wireless providers use a technique called 
"number pooling". This technique allows the service provider to commit a block of numbers per switch to a pool of 
numbers that are assigned/owned by the carrier that are only used for internal routing, never (in theory at least) to 
be assigned to its subscribers for external use. When a foreign/extemal number is ported into the switch with a 
new subscriber, one of these internal numbers is assigned as an alias to the new subscriber’s account, and the 
switch uses this internal alias number to internally route calls to and from the subscriber. This technique allows 
the wireless providers to implement WNP without having to redesign their entire switching infrastructure. 




b2 

b7E 


We have found an evidentiary probl em caused bv some U.S. w ireless providers' implementation of numl 
.. ThPi lfi-41 hasftrl nrnviftenl * 


(S) 


\ and other CDMA/TDMA providers) use th« 

I [ identification (MSID) feature of IS-41 tcuaualpment numl 

pooling, l hese earners usually assign one of the numbers from their internal pool to th el bnd assign the 

* ' to th d 

e world to call the 


S ti directory number (either one ofJbeitqwn numbers or the ported number) to th j | 

Jissigned to the phone. Note th i Is the number used bv the re st of the world to call the subsenber. In 

intercept cases, we have found tha t I switches sometimes only report the 

the calling party for incoming calls. We have found this to happen when the associate calling the target is a 
wireless subscriber served by the same carrier and the s ame s witch as the target for the call. In this scenario we 
have fo und the JSI VoiceBox III (version 3.6) extracts th j [ as the calling party number, which is not the 
PYtemal[~ hf the calling party. This error has recently misled a f ew FBI investigations. In one case, the 
intercepted”] of the target’s associate was actually assigned as a l | o another subscriber with no relation to 
the target, uue to the misinformation presented in the call records, the unrelated subscriber was temporally 
included in the investigation. 


We remedied this problem on the DCS-3000 by ignoring th j b f the calling party in thef 

Termination Attempt message and using the caller id field that is usually presented in the ITSWfirk Signll message b 2 
that is delivered for incoming calls. In the case where the calling associate blocks his/her caller id and the b7E 

Network SjflQal message does not present the caller id we simply leave the calling party number blank rather than 
using the | \ 

a ot sure if Canada has the same problem. But, I thought it was appropriate to share the information with 

ust in case. Also, we notified JSI about the problem a few weeks ago; and hopefully they will have a patch 
hat solves the problem. 


There was a second problem that I informed the TTEC subgroup: the "*82" Q 


] This problem was 


documented by the SOLVER lab when testing the DMS platforms many years ago. If an intercept target dials "* 
82" to d isable caller id blocking (to allow his/her caller id to be delivered to the called party for the one call), the 
g JDMS platforms cease call intercept, and law enforcement will not be able to intercept the call content nor 


SB^ET 




I may have missed you response, I got a lot of e-mail to catch up on. Please see the note below, (your 
comments in "red" ) and provide some feedback to me re your comments in Canada. 


I please set 'T' for Firday 5 August 2006. 


^ — J_^indicated that under certain circumstances, | 1 

~\ switches can provide "incorrect" metadata 
(specifically, metadata that are linked to subscribers other than 
the target (s) of an interception operation). 



□ . 

Please respond to | | with the following message and we will follow 

up with details later: 


[==□ 

Thank you 


Thank you for your kind words. But we should be thanking you for 
hosting this symposium, we all know how time consuming these events 
can be. The feedback that I have received so far mirrors your 
comments, great job to all of you. 
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I will talk with! 


I / 1 today regarding the matter of I I 

I ~l switches which on occasion provide "incorrect" 

metadata, specifically metadata that is not linked to the target. 

He or I will provide a response back as soon as possible. 


for your inquiry. 


KI6fiWMU.fi yurvsiii&rtce Technology Section 


rjtico^Vira^i : 


.nia 


b6 

Jb7C 



](OTD) (FBI) 


NON-RECORD 


Can you please review the attached email sent to my attention via 
TTEC Net. Let m e know if you have any response/ feedback and I’ll 
forward it on fco | | Thanks 


□ l-u 

As you know.!-- hosted a Collection System Symposium earlier 

thiS' week, Jncirr had the privilege of attending in large part, 

as an observer. Based on what I heard and saw, I think this was 
a very successful event. 


Please pass our thanks to l 1 for having arranged the 

FBI's participation to this event, and please also thank all 
members of your delegation for their active contribution to the 
Symposium. 

My colleague I 1 who co_hosted this meeting, has 

asked me to follow up on information that he obtained during the 
Symposium. At s ome point durin g the discussions, one of your 
representative s . I I T ndi oat ed that under certain l b2 

circumstances , 1 I switches can provide 

"incorrect" metadata (specifically, metadata that are linked to b: 
subscribers other than the target (s) of an interception fc' 

operation) . 

Would it be possible for you to ask | ~1 and | f 

| ~~| whether they could provide us more details on this 

problem and how to reproduce it for analytic purposes . Since 




* | technology is deployed and used in Canada, 

we would like to make sure that we understand this problem and 
hopefully contribute to its analysis and resolution, in concert 
with your colleagues. 

Should 1 I wis h to discu ss this wit-hl I 

| please note that. | | can be reached at +1 613 I 

[ iion_secure line) . ■ I 

If possible, please send me a receipt confirmation for this 
e mail. 


Thanks in advance for your response, and best regards! 



lb 2 
be 


b7C 


Engineering Research Facility (ERF) 
Operational Technology Division (OTD) 


Te chnical Liai son Office (TLO) Room A214 

7o| Ifax) 

20JJ Jcell) 


bl 

lb6 

fo7C 



SEI 




© 


3 LAC KARO, KENNETH L. (OTDf (FBI) 


l(OTD) (FBI) 

August 03. 2 006 5:29 PM, 

OTP) (FB|) j- 

Eymposium Follow-up Questions 


The problem I described at the TTEC meeting is related to wireless number portability. Today, U.S. wireless service 
providers are required to comply with the wireless number portability (WNP) mandate issued by the FCC a few years ago. 
WNP allows a wireless subscriber to take his/her telephone number from one carrier to another carrier. In essence the 
subscriber owns the telephone number, not the service provider. This mandate created technical problems for the U.S. 
wireless providers because their switching infrastructure routes calls based on telephone numbers: carrier owned (internal 
numbers) are usually routed differently than external numbers. 

Before WNP, routing calls were simply based on routing tables, which were populated with NPA-NXX and trunk 
combinations. These combinations are point codes the switch uses to determine how to route the call. W NP hlurs the hi 

distinction between internal and extern al numb ers, and therefore complicates call routing For example if al I fo" 

subscriber decides to switch service to l fe n d requests his number to be ported from ! I 

^switch j ig network will have to accept the extemal l l assioned number as it's own and route it as if it belongs to 

To route and manage external numbers as internal numbers, the wireless providers use a technique called "number 
pooling". This technique allows the service provider to commit a block of numbers per switch to a pool of numbers that are 
assigned/owned by the carrier that are only used for internal routing, never (in theory at least) to be assigned to its 
subscribers for external use. When a foreign/extemal number is ported into the switch with a new subscriber, one of these 
internal numbers is assigned as an alias to the new subscriber's account, and the switch uses this internal alias number to 
internally route calls to and from the subscriber. This technique allows the wireless providers to implement WNP without 
having to redesign their entire switching infrastructure. 

We have found an evidpnfiarv nmblp.BLcauspri by some U.S. wireless providers' implement ation of number pooling. The 
[S-41 based providers! [ and other CDMA/TDMA providers) use th^ | 

I I featurp.,ofJS-4l to implement number pooling. I hese camera usually 

assign one of the numbers from their inter nal pool to thd Ind assign th e external directory number (eithepawbof their 
own numbers or the ported number) to the ! t assigned to the phone. Note thel Is th e 

number used by the rest of the world to call the subscri ber. In recent intercept cases, we have found that| [ 

I I sometimes only report the j b f the calling partyfor incoming calls. We have found this to 

happen when the associate calling the target is a wireless subscriber served by the same carrier a nd the same switch as 
the target for the call. In this scenario we have found the JSI VoiceBox III (version 3.6) extracts th d l as the calling 
party number, which is not the ext ern q t f the calling party. This error has rece ntly mis led a few FBI investigations. 

In one case, the intercepte d b f the Targets associate was actually assigned as a l It o another subscriber with no 
relation to the target. Due to the misinformation presented in the call records, the unrelated subscriber was temporally 
included in the investigation. 

Jh/VJ remedied this problem on the DCS-3000 by ignoring the| | of the calling party in the J-STD-025A Termination 

‘■Attempt message arid osing the . caller id field that is usually presented in the Network Signal message that is delivered for 
incoming calls. In the case where the calling associate blocks his/her caller id and the Netaotb. Signal message does not 
present the caller id we simply leave the calling party number blank rather, than using tha"__~j 

I am not sure if Canada has the same problem. But, I thought it was appropriate to share the information^™ 1st in b 
case. Also, we notified JSI about the problem a few weeks ago; and hopefully they will have a patch soon th at biUlveJ the h 
problem. fc 

There was a second problem that I informed the TTEC subgroup: the "*82" | "p roblem. This problem was 
documented by the SOLVER lab when testing the DMS platforms many years ago. If an intercept targe t dials to 
disable caller id blocking (to allow his/her caller id to be delivered to the called party for the one call), thd bMS 
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ET w 

platforms cease call intercept, and law enforcement will not be able to intercept the call content nor the digits dialed after "* 
82”. 


□ 


bo 

hlC 



NON-RECORD 


h> 2 
be 
b7C 
b7E 


missed you response, I got a lot of e-mail to catch up on. Please see the note below, (your comments in 
"red”' ) and provide some feedback to me re your comments in Canada. 



| please set "T" for Firday 5 August 2006. 



F ] indicated that under certain circumstances, [ 

witches can provide "incorrect" metadata (specifically, 


metadata that are linked to subscribers other than the target (s) of an 
interception operation) . 


Electronic Surveillance Technology Section 
Operational Technology Division 

T 3 


fo6 

b7C 


(S>; 


—-Original Message^^ 


] (OTD) (FBI) 
“:22 AM 


iv 28. 200 6 8:22 AM 

K oto) (rei);L 

i MltHAEL (OTD) (FBI)[ 


_ I (OTD) (FBI~) 1 
lposium Follow-up Questions 


□ (OTD) (FBI) 
T (OTD) (FBI) 


«FN«rnVE BUT IIMOI ARglPIgn 
NON-RECO RD 


bl 

b6 

b7C 


[=□ _ 

Please respond taL 


with details later: 


with the following message and we will follow up 


I I 

Thank you for your kind words . But we should be thanking you for 
hosting this symposium, we all know how time consuming these events can 
be. The feedback that I have received so far mirrors your comments, 
great job to all of you. 



I will talk w ith I I todav regarding the matter o£ I 

| | a witches which on occasion provide “incorrect" metadata, 

specifically metadata that is not linked to the target. He or I will 
provide a response back as soon as possible. 


I Thanly 


for your inquiry, 


Electronic Surveillance Technology Section 
Oua ntico . Virg inia 

703-j T 


b2 

b6 

b7C 

fc7E 


Sent Friday. July 28. 21 


(S) Subject j* | ymposlum Follow-up QuestiJH? 


^JOTD) (FBI) 


b6 

b7C 


GEHOITIVC DU f UIHCLAS S1FT1 
NON-RECORD 


<S) 


fol 

fos 


J ou please review the attach^ 

Le t me know if you have any response/ feedback and I'll forward 
to \ | Thanks 


□ 


(S) 


As you' ktiQW-rr posted a Collection System Symposium earlier this 

we.ek-r Which *1 hSd the privilege of attending in large part, as an 
"observer. Based on what I heard and saw, 1 think this was a very 
successful event. 


b2 

b6 

fo7C 

b7E 


Please pass our thanks to ( I for having arranged the 

FBI's participation to this event, and please also thank all members 
of your delegation for their active contribution to the Symposium. 


My colleague I 1 who co__hosted this meeting, has asked 

me to follow up on information that he obtained during the Symposi 
At some po int during the discussions, one of your rep resentatives 
I in dicated that under certain circumstances, [ 


J switches can provide "incorrect" metadata (specif ical 


fn 

iy. 


metadata that are linked to subscribers other than the target (s} of an 
interception operation) . 


Would it be possible for you to askl I and | | 

whether they could provide us more details on this problem and how to 
reproduce it for analytic purposes. Since l - 1 

technology is deployed and used in Canada, we would like to make sure 



that we understand this problem and hopefully contribute to its b7c 
analysis and resolution, in concert with your colleagues. 

Should f II wis h to discuss this with! I 

please note that | | can be reached at +1 61 3| | 

{non_secure line; . 

If possible, please send me a receipt confirmation for this e_mail. 
Thanks in advance for your response, and best regards! 


IS, £ 


Engineering Research Facility (ERF) 
Operational Technology Division (OTD) 
Te chnical Liais on Office (TLO) Room A214 


fol 
b2 
lb 6 
b7C 


' " SbWSI II tf C BUT UHOLAOO i nCP 
6 E N6 IT I VE B W - UNCUABSi HEB- 
SE W QiTIVr P t ff U N OLAOO tfffiB 


3S1BU£B!1 . 


From: 

Sent: 

To: 

Cc: 

Subject: 




( FB| ) 


-MHUlLAUlilFiED 

NON-RECORD 


(OTD) (FBI) 


b2 

b6 

b7C 

b7E 


1=1 

I'm glad to hear our enhancements to the Client have been well received. We are still working on the Client's concatenate 
feature for the Trace files. In the interim, I have written a simple program that will help you do the concatenation of the 
trace files. A shortcut named "Trace Cat" is located on the .16 machine's desktop. When you run this application it will 
prompt you for the start date and time you wish to use for the concatenation. Note the default start date is the current date 
minus 1 day to assist with daily archiving. If you need to change the date or time just enter "n" when prompted and enter 
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o 


the desired date or time. The applicatidn compares each record in each .trace log file against the start date and time and 
writes the filtered records to a single file. When all the .trace files have been processed the Windows notepad application 
is spawned and the concatenated file is automatically opened. From here, you can print save, etc. using the notepad 
features. 



imr*. nocin cn 

NON-RECORD 


Hi guys, 

We upgraded our machines. We really like the changes. It's funny how the smallest things can make your day. We 
like that all the features are visible, ie SMS, Post Cut Digits, etc., on the window used for entering the target 
information. We also like the change from "Dialed Digits Displayed” to the standard court order terminology of "Post 
Cut Through Digits." (It would be nice if "Location Authorized" could also be changed to the standard court order 
terminology of "Cell Sites Authorized.") We were a bit disappointed that we still cannot concatenate the TRACE files. 
We really LOVE the concatenate feature. As you know, we have dropped the 3094 and have been using the 
concatenate feature to upload our CDNRS files for about two weeks now. It is awesome! Please thank all at TICTU 
for their tremendous work. 

□ 


foe 

b7C 


NON-RECORD 


I will forward the below info, to the Tel Apps people and see if they can get it corrected. 
Thanks, 

TTAt I 


fo2 

fo6 

fo7C 

fo7E 


— Ori ginal Message— 

From: [ 


tOTD) (FBI) 

Sent pWlHMSy. II IIU )) Z0Pg^:Q2 am 

l«L, , 

Subject; ke: i ■ 


□ 

Since TA is an analytical tool we pass all the dialed digits from the DCS 3000. Have you contacted TA to see if 
they can modify their system to handle this types of called numbers? 

□ 

b2 Original Messa np 

fo6 From: I I LA) (FBD 

fo 7 c Se nt: Monday. J uly 24. 2006 2:28 PM 



NON-RECORD 
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I just spoke with ! l Thev are familiar with this. They said the customer is not actually dialing 

the 01 1 . Apparently this occurs when the customer makes a call that is handed off to the nidi I 

network. They claim during the handoff a 01 1 is added. Here.is a sample of two calls that were rejected today 
and the associated log file: 



« File: 090512.205 » 


— Original M« 

From: 

Sent: 

To: 

Subject: 


. Monday. July 2 V 
L 


J(OTD) (FBI) 


2006 10:3' 
^ (FBI) 


b2 

b6 

b7C 

b7E 


NON-RECORD 


□ 


ave an example call or target number? 01 1 is usually for international calls. 1 1+number is used 
[to access voicemail. We need to look at the data to determine why it's happening. 


— Original Mess age 

From: I I f LAI (FBI) 

IT i 

Subject: | 1 | 


[OTD) (FBI) 



© 


NON-RECORD 



lb 2 
be 
fo7C 
b7E 


Hi guys. 


I have a quick question abou] (This may be something you have long been 

aware of but, since I lus t started going tne u ploads. I have not seen it before. On some 
outgoing local calls with| |sens the raw data indicates a 01 1 was dialed 

before the number. As a result this number does not get uploaded to telephone apps. 

Instead the call is rejected as an error "MISSING TO NUMBER." These are completed calls, 
with a du ration. This is occu rring with different targets on unrelated cases. All are outgoing 
calls from ! l phones to local numbers here in LA. I can't believe would be 

dialing 01 1 before they make a local call. Do you know why this is happening? 


UNCLAiibll IClT 


U N GLAGGir iEfr 


From: 

Sent* 

To: 

Subject: 


l(OTOHFBI) 

I IOTP) (FBI) £2 

■Thursday .July ?7,2006 1 0:02 am 
I , |LA)(FBI) ^ 

RE i I b7{ 


NON-RECORD 


□ 

Since TA is an analytical tool we pass all the dialed digits from the DCS 3000 . Have you contacted TA to see if they can 
modify their system to handle this types of called numbers? 
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NON-RECORD 




fc7C 

b7E 


□ 


I just spoke They are familiar with this. They said the cust omer is not actu ally dialing the Oil. 

Apparently this occurs when the customer makes a call that is handed off to the ol d h etwork. They 

claim during the handoff a 01 1 is added. Here is a sample of two calls that were rejected today and the associated log 
file: 



« File: 090512.205 » 


— Orig inal Message— 


□ (OTD)(FBI) 


Sent Monday. July 24. 2006 10:39 AM 

to: i , iLM rran 

Subject: RE j I 


b2 

b6 

b7C 

b?E 


NON-RECORD 


[=□ 


Do you have an example call or target number? 01 1 is usually for international calls, 
to access voicemail. We need to look at the data to determine why it’s happening. 


11+numberisused 


»□ 


□ 


— Original Message — 

From: I " I fLAI (FBI) 

Sent; Mond ay. luiv 24 i -m pm 

To: | l (OTD) (FBI); | | OTD) (FBI) 


b2 

b6 

b7C 

b7E 
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NON-RECORD 


Hi guys, 

I have a quick question about ! i Thls may be something you have long been aware 

of but, since I lust starte d doing the uploads, I have not seen it before. On some outgoing local calls 
wit i Jp ens the raw data indicates a 01 1 was dialed before the number. As a result 

this number does not get uploaded to telephone apps. Instead the call is rejected as an error 
"MISSING TO NUMBER." These are completed calls, with a duration. This is occurring with different 
targets on unrelated cases. All are outgoing calls from j p hones to local numbers 

here In LA. I can't believe would be dialing 01 1 before they make a local call. Do you know why this 
is happening? 





92 




Can we download a number and its information from the tracking system to a disk? An agent is 
inquiring about this because the attorney's office said he needs the information to present to the 
judge 





(OTD) (FBI) 


RECORD 212A-WF-224477 


Well, I wasn't looking at numbers .... Just thinking about numbers. And yes, I do need to get a life - 1 had one until I took 
this job. 


IfFm (FBI) 

.July 24, 2006 11.21 AM 

| (OTD) (FBI) 


RECORD 212A-WF-224477 


| | it worries me that you are looking at | I numbers on a Friday night, boy I thought Ineeded to get a life. 


Original Message— 

From: | 

Sent: ‘MnnHav. lulv PT. 


RECORD 21 2A-WF -224477 




I am sorry for the earlier mistake: haste makes waste. 




T 



Q 




](OTD) (FBI) 

""I AM 

(OTD) (FBI)|_ 


3 °td) (FBI) 


b2 

he 


lb 70 
lfc7E 


RECORD 21 2A-WF-224477 


□ 

I have numbers for i ~l that I believe are accurat e. I processed all the intercept ed call 

records on our DCS-3Q00 system for both carriers for the period of | | Here are 

the results: 




Sincj fras a simple cost fee schedule, tl 

ie costs were easily calculated using the following formula: 




It is i mpossible fo r me to accurately calculate th j h osts using the data from the DCS-3000 system 

since f I costs are a function of the number of switches provisioned with the target. Since the number 

of switches vary with each intercept order I cannot accurately calculate the cost. 



b2 

he 

b7C 

b7E 


Cc: 

Subject: 


RECORD 21 2A-WF-224477 


06 10:50 AM 

1222) (FBI); I \ (OTD) (f 

l(FD) (Ffc 1 


] (OTD) (FBI) 


Hello Gentlemen - 

| has been dragging their feet in getting back with us regarding the number of lines/targets we 
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ib2 

be 


b?C 

b7E 


b2 

b7E 


b2 

be 

b7C 

b7E 


b2 

b6 

b7C 

b7E 


have with them. So I met wit h! h o discuss the contracting issue. Here's what we came u 


with and would welcome your input. 

Sinc d l has been slow in responding, let's start with I l you indicated that you have a 

good relationship with them, (and they're starting to charge us) can you get an indication of ccwerage from 
them, r egarding a ll of our stuff t o include anythinojflutlaihe Bureau name on it (to inc lude joint I I coverage 
etc) an q| | Then T"~ l ean you pull from] Jvhat numbers you have with| |2o we can 

compare the two" I I 1 1 

What we're looking to do is get a snap shot of actual lines being used that we can verify. Then, what 
f I will do Is add a rider in the contract that will allow for an increased amount/coverage. What she is 
concerned about in getting into a big excessive contract with the carriers and then not using the service 
(i.e, paying/contract for 600 lines and only using 300). 

They other thing we were looking to do to jump start this is to go through the government sales/marketing 
people of the carriers and not the security people. S ince this will be an overt contract and other Law 
Enforcement Depts. & agencies, along with ! 1 would be our customers and not the vendor's, we 
should be able to go through open government sales w ithout issues (PLEASE correct me if I am wrong!!) 
So if either of you know a sales oerson/co ntact in e ither ! T ar can find o ' 


d out through your 
II like to have something in place for 

b6 
b7C 

So, to sum up... I need you gentlemen help with the following action items: 


other channels/contacts, please let me anc | [ mow. We would s 
October 1st. 



(*l recognize it may not be an actual represen tation of all c overage due to the field offices not all 
using TMD etc, but we have to start somewhere. And [_ ' 

get the Finance Division to help promote TMD.) 


□his may be the springboard you need to 


If possible can you get this information to me by this Friday? (Please, please, oleasel I apologize for t he 
short deadline, but I was hoping we might be able to talk about this at Friday's! Iwill 

not be able to join us at the meeting, but I will be meeting with her later Friday anemoon. 


for your help and suppoi 

rau are both welcome to attei 


will see you on Friday at 10:00am here in 1B045. 1 
you like as well. 


Thanks 


□ 


Ubiu/sspeciai Krojem fos 

FBI HQ/CD-8A, Roo m 1B045 b7c 

m I 


SECRET 


ROM: G-3 FBI Classification GuideG-3jlatedJ/j^ ^ 
ICATfON EX^fPFWaLf^ 


>M: G-3 FBI Classification Guide G-3. dated J/9^greig^^Co^ltSlto^6yiflgBSfc^ 









RECORD 212A-WF-224477 



:e | [ has a simple cost fee schedule, the costs were easily calculated using the following formula: 


it is impossible for me to accurately calculate the I h osts using the data from the DCS-3000 system since l j 

I h osts are a function of the number of switches provisioned with the target. Since the number of switches vary 

with each intercept order I cannot accurately calculate the cost. 




Hello Gentlemen - 


I l ias been d ragging their feet i 

them. So I met with I 
welcome your input. 1 1 


in getting back with us regarding the number of lines/targets we have with 
to discuss the contracting issue. Here’s what we came up with and would 


Since] I has been slow in responding, let's start with ! I you indicated that you have a good 

relationship with them, (and they're starting to charge us) can you get an indication of coverage from them, 


regardin g all ofour i stuff to include anyth ing wit h 
1 | Therl ton you pull from! U 


the Bureau name on it (to i 
hat numbers you have with 


coverage etc) and 
e can compare the two. 


SEbl^T 



b2 

foS 

hlC 

b7E 


fo7C 

bVE 


%4t 


What we're looking to do is get a snap shot of actual lines being used that we can verify. Then, wha j jv ill do 
is add a rider in the contract that will allow for an increased amount/coverage. What she is concerned about in 
getting into a big excessive contract with the carriers and then not using the service (i.e, paying/contract for 500 
lines and only using 300). 

They other thing we were looking to do to jump start this is to go through the government sales/marketing people 
of the carriers and not the securi ty people. Since this will be an overt contract and other Law Enforcement Depts. 
& agencies, along with | fl i/puld be our customers and not the vendor's, we should be able to go through 
open government sale s withouT issues (PLEAS E correct me if I am wrong!!) So if either of you know a sales 
□er son/con tact in eithe l l or can find out through your other channels/contacts, please let me 

and I know. We would still like to have something in place for October 1st. 

So, to sum up. ..I need you gentlemen help with the following action items: 



(*l recognize it may not be an actual repueseBlatiQP.of all coverage due to the field offices not all using 
TMD etc, but we have to start sopeadififig. And| [his may be the springboard you need to get the ^ 

Finance Division to help promotej | 


b7E 


If possible can you get this information to me by this Friday? (Please, pipas^ niaas^ I anninnryp for the short 
deadline, but I was hoping we might be able to talk about this at Friday's | pill not be able i 

join us at the meeting, but I will be meeting with her later Friday afternoon: 1 


Thanks for your help and support l" l l will see you on Friday at 10:00am here in 1B045. | 
are both welcome to attend if you like as well. •— 


]you 


c 


□ 


OSIC/Special Projects 
FBIH Q/CD-8A. Ro om 1B045 
( 202 ) | | 


be 

b7C 






lOTD) (FBI) 


From: 

Sent: 

To: 

Subject: 


1 (OTD) (FBI) 

Friday jam 222255 >m 

r (HN) (FBI) 

rE: DCS3666 


be 

fc.7C 


NON-RECORD 


b7C 


I'm curious why you’re setting up a pen-register line on the VB. 

□ 


al Mfyjfflfle— 

I —I (HN) (FBI) 

Friday, .3uly.2,l,. 2006.6:35 PM 
I I (OTD) fFBTI 

I — l(HN) (FBI); I 


fee 

b7C 


>N) (FBI) 


be 

b7C 


bl 

b2 

b7fi 


□ (S) 

Have been setting up a pen register for a l l ine in VoiceBox III, vs, 3.6. and in the DCS3000. Appears to be 
working in the DCS3000 but. for some reason VB dnas not have access to the DCS30 00. JSI suspects th e Pix firewall 
is not allowing VB access to the DCS30Q0I s hows ISG12 and ISG2 down I l input status is 

shown as Unknown. Cannot ping l h >m VB: had restarted JSI Service Manager to no avail. Never had 

this problem previously, only since we have upgraded VB to 3.6 earlier this year. As far as I know no, IP addresses 
have not changed. Any guidance on how to work this is appreciated. 


! Thantei 


TTA 

Honolulu 

Division 

808 


Desk 

808 


Dell 


^PwefcAsaiFiEp 

rrr ii i mi ii i i n 



o 


From: 

Sent: 

To: 

Subject: 


%T 

3otd>(fbi) 


^Friday. July 21. 2006 6:46 PM 


J(OTD) (FBI) 


(HN) (FBI) 


be 

b7C 


Tmi i ^rnnrri 

NON-RECORD 



□ 


be 

fe 7 C 



](HN) (FBI) 


NON-RECORD 


riSK 

Have been setting up a.pen register for 
working in the DCS3000 but for some real 
is not allowing VB access to the nr.gmnn 
shown as Unknown. Cannot pini 
this problem previously, only sii 


te pnfHnnn 14. 

>ina Iro 

since we nave upgi 


b2 

b7E 


ine in VoiceBox III, vs. 3.6. and in the DCS3000. Appears to be 

jot have access to the DCS30Q Q. JSI suspects t he Pix firewall 

Ishows ISG12 and ISG2 down. I ( input status is 

•om VB; had restarted JSI Service Manager to no avail. Never had 


jraded VB to 3.6 earlier this year. As far as I know no, IP addresses 
have not changed. Any guidance on how to work this is appreciated. 




IHonolulu D ivision 
8| pesk 

81 Pell 


be 

b7C 


-Wjgi ASS1E1ED 


SEfe^ET 
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fo5 

fob 


d= 

From: 

Sent: 

To: 

Subject: 




[OTP) (FBI) 

I tOTm (FBI) 

■ Friday, July 21. 2006 3:59 pm 

I f OGCi (FBI) 

RE: Brief Question 


e 


RECORD OIPR 0001 


I don’t think there's one, absolute answer. In general, I think the carriers deliver CDC by default if there’s a content order. 
For exampl d t vill not provision a content order unless the CDC circuits and connections are already in plaj ~ 
claim their intercept software requires the delivery of CDC simultaneously with the intercepted c 

requires content orders to expressly state the need for PR/TT - you can double check this with], 

more liberal in their interpretations. Just yesterday, the Richmond field office called with the problem that a FISA pen was 
receiving cell-site an d post cut-through digits, which their CDC s airi was nnt covered in the order. When the office fo2 
contacte d I to ask for the information not to be delivered ] fe aid something like "but it’s a FISA". foe 

fc7C 
fo7E 


□ 


Original Message-—- 

From: I I fOGG (FBI) b5 

Se nt: Friday, July 21. 2006 3 :42 PM b6 

To: I l (CTD) (FBI) fo 7C 

Subject: RE: Brief Question 

Importance: High 


RECORD OIPR 0001 


Thanks-if there’s a full-content fisa surveillance order served on a provider, does the provider send the CCC and CDC 
or only the CCC unless the order specially also orders deliver of the PR/TT or associated data? OR is the answer-it 
depends on the provider— Some carriers will provide it along with everything else, while others will stipulate that the 
order must contain specific text identifying location as required..? 


— Orii 
From: | 
Sei 
To: 


t 


Fririav . Inlv 71 2006 3:28 PM 
J(OGC) (FBI) 


J(OTD) (FBI) 


Subject: RE: Brief Question 


fo5 

foe 

fo7C 


RECORD OIPR 0001 


b2 

fc7E 


We can block the information on the DCS 3000 -] 




ET 


] 




fcs 

fcs 

lb 7 C 


b5 

be 

b7C 


^<ET ® 

I I The other systems cannot. 



— Or iginal Message — b?c 

From: f I fOGO (FBI) 

Se nt; Friday. July 21. 2006 1 2:35 PM 
To l I (OTP) (FBI) 

Subject: FW: Brief Question 
Importance: High 


L2 

b7E 


l 

RECORD OIPR 0001 

be 
b7C 


what's the answer? can we at the collection end tell the equipment NOT to receive the cell site location 
information? 



Another related concern is whethe r if the field has ONLY a PR/TT orders (no 2703(d)) authority but the 
provider send th i bata along with the PR/TT data~do we get it all or can we, when required, 

tell the equipment to not collect the | | data? 


fenal.^essafle^---. 

TOGO 

Se nt: Thursday. July SO. 2506 6:52 PM 

Toi l l (OGC> (FBI), 

Cc: l J OGC) (OGA) l 


Subject: Brief Question 


]0GC) (OGA) 


b2 

b7E 


•" SLCRCT - 
RECORD OIPR 0001 


[=□ 

I am one of the OIPR attorneys working on the l i rief and was at the presentation ERF gave 

to OIPR about cell site location information several months ago. 


b2 

b7E 


A question was posed to me today that i thought you or others there may know the answer to - currently, from 
a technical position when a full con tent FISA is approved (as opposed to just a pen register or business 
records request) is I i information obtained an d provide d to the field, along with the other take, or 

does a specific, separate request need to be made to obtain ) i nformation? 

Thank you, both for your assistance with this inquiry and for all your help over the past few months with this 
topic. 


Thanks again. 

I | OIPR 
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SEfetiET 
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To J , 

Subject: FW: Brief Question 

Importance: High 


T 

lOTD) (Ftfp 


RECORD OIPR 0001 



what's the answer? can we at the collection end tell the equipment NOT to receive the l I nformation? 

An other related conc ern is whether if the field has ONLY a PR/TT orders (no 2703(d)) authority but the provider send 
the l hata along with the PR/TT data-do we get it all or can we, when required, tell the equipment to not 

collect the l b ata? 


From: 
Sent: 
To :[" 
Cc: 


Ori ginal 




_OGC) 

mrsdav. July 2O006 6:52 PM 

J (OGC) (FBI) 

J(OGC) (OGA) J 


Subject: Brief Question 


fas 

b6 

b7C 


]OGC) (OGA) 


RECORD OIPR 0001 b 5 

b6 

b7C 

□ 

I am one of the OIPR attorneys working on the l | ef and was at the presentation ERF gave to OIPR 

about cell site location information several months ago. 

A question was posed to me today that I thought you or others there may know the answer to - currently, from a 
technical position, when a full content FISA is approved (as opposed to just a pen register or business records 
request) is| information obtained and provided to the field, along with the other take, or does a specific, 

separate request need to be made to obtair f I nformation? 

Thank you, both for your assistance with this Inquiry and for all your help over the past few months with this topic. 
Thanks again. 

b lPR bo 

l item porarv) b7c 


b2 

b7E 


b2 

b7E 
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